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completion date: 

N ' x "‘uvuv'i a* (XVw?'!^ \ safkamm 

_Don! Know. 

B. Is this system/p.roiect the subject of an CMB-300 budget submission? 

.NO _Don’t know .X.YES If yes* please provide 

the date and name or title of the 
OM8 submission: Security 
Management Information System 
(SMiS) 

9. Is this a national security system t as determined by the SecD}? 

X_NO YES __ Don't know 

















10, bt,v,m of v \Aw" 'mxvt 

This is a new system/ project in development. Ill yon. checked this block, 
x t OF. 1 Fs F1 \ w !^s« \Osnpkw and .mm dn men opp* Humid O 

submitted to FBI CBOC/FCLil lor final FBI approval and determination if 
P1.4 and/nr other aello.es are required* f 


IL F\1S !lNFS\81i-M\, PROJECTS 

1. When was the systenvprpject developed? 2003- 2005 manual submissions. 2000 - 
2009 electronic submissions 

2. Has 0 k as oem pngeei owkrg'vu am ssymmant change * w,' e \orn I". 2 do? ' 

NO [if no, proceed to next question (113).] 


X _ YES If yes,, indicate which of the following changes were involved (mark all 
bos.es that apply): 

X A conversion, from paper-based records to an electronic system, 

Vhe eorxerwm occurred pw <r to bv 20do II .A 

,4 change from information in a format that is anonymous or .non- 
'J nv.hw'e f ' a 'mv; mm xhxw'vKe to p mxxh r t xfo lee fo 

A new use of an IT system/protect including application of anew 
technology, that changes how information in identifiable form is managed. 
(For example, a change that would create a more open environment and/or 
avenue for exposure of data that previously did not. exist.) 

_ \ Emma,, h .a '<• en'm m wmsm.mo'' m xicm''xhxc tone K"n„ 

merged., centralized, or matched with other databases. 

\ rev mefo.xl X ml '.vimc.xOt'c be ew o, end mx-ws >.*> 

W X . ' ' "O" ' ' X' ^ " . 

' s ,, 

X ' ! "X ''e S' O' p 0" woe . OvV.ev .'"0 X'v e S p ''l ''' >'X . 

___ A new interagency use or shared agency function that results in 

new uses or exchanges of information in identifiable form. 
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CnOasssthd 


\w' V . ' 'v 0 ' ' ' ' * ' 

5denfolee;e form. 

_ A change that results in new items of information in identifiable 

form being added into the systera/project 

X Changes do not involve a change in the type of records maintained, 
the individuals on whom records are maintained, or the use or 
dissemination of information from; the systsm/project. 

Other fProvide brief evpianatfouj: 

3, Does a PIA for this system/project already exist? 

.NO .X YES 


a. Provide date/title of the PIA; 02/24/2006, PRIVACY IMPACT 

xsfo'foAit \i civ, v t cruy oiviyioN ;\oi t \p \' \no\ or nn 

\ V \ N N N x O O ^ ' \ ^ . \ ' v ' 

SYSTEM) 

' ^ ' ' 'e ^ v'v » ' ' ■, ■, e^w e ' x 

A NO . YES 
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FEDERAL BUREAU OF INVESTIGATION 
FOI/PA 

DELETED PAGE INFORMATION SHEET 
FOI/PA# 1272295-0 

Total Deleted Page(s) = 2 
Page 4 ~ b7E; 

Page 6 ~ b7E; 


XXXXXXXXXXXXXXXXXXXXXXXX 
X Deleted Page(s) X 
X No Duplication Fee X 
X For this Page X 
XXXXXXXXXXXXXXXXXXXXXXXX 
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Ps'A is no? fxxourcd for foe foikasiog resssads): 

%«aon does noi .coHed, 3»s infos?'.. or tiissoroiosio Pi; 

NysSen; is grand i as hsi\?d (in excsSUTOO before 4/i /foods; no doer changes 
fofovrnadoo 35 - foe system sxfooes to enemas government opens-fora; 
SysSeu; hss been previnnsiy assessed nndor an evfoofoon surfoar to a P!/ 
No signifiessn gnsnsey issues Tor prsvacy sossrex a;x f eneinsssged). 






































J, INFORMATION ABOUT THE SYSTEM / PROJECT 


! , Provide a general description of the system or project that iuetrsfet (a) name of 
the syMesm'projeei, Including associated serum ms: (h) structure of tht 
system/projeeR Including mtereoimeetoms with ether projects or systems? fej 
purpose of the xy sfem/projeet; fd> nature of the irsfonsatioa la the systeobprejeet 
urn! how it will be used; (e) who will have access to the Informatinn it* tbe 
sy\sten*/projeet? ft) and the mo otter of transmission to ail users. 

1'he National Name Check Progmoi iNNCF}, which ope rates in the Records Management 
Division t"Rlv1D> of the Federal Burette of investigation, processes name check requests 
for federal agencies, including the Department of Homeland Security'a U.S. (.'Rizer.ts.hip 
and immigrations Services <USOS), the Office of Personnel Management (OPM). end 
the Department of State (DOS)< Information obtained from the NNCP is used to 
adjudicating matters rela ted to Governm ent employment, federal appointment security 
clearances, attendance tn | | functions, Issuance of immigration bene tbs or & b7E 

isa. and namntlR at ion petitions 

In ottier to provide information to meet customer needs, the NNCP conducts searches of 
the F BI's Central Records System (CRS), which Includes records from FBI Headquarters, 

FBI Field Offices,, and Legal Attaches. Records accessed Bom these locations contain 
FBI investigative, administrative, personnel, and genera! fries, NNCP analysts review 
and analyse potentially Meuti.frable documents to determine whether a specific Individual 
has been the subject of, or is mentioned In. any FBI investigation. If any relevant 
information is discovered, it is disseminated to the requesting agency, subject to 
appropriate legal and operational restrictions* The requesting agency uses the 
information in its adjudication process. 


I lou.J .,o N ( - ' ,V\ - s \ t \w ^ e m 

IvoNv \ ■■ ■ ■ ~| 

| ^ NORs business processes 
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b7E 


Transactional data. to include audit logs of aetivides performed, will be stored in the 
system transactional data includes * opies of information. used by the NNCP Research. 

' oh si t v*. s the request < ig \sith tins c spies aforma n ser o \ 
requesting agency. fransaetk nal data. v. ill be maintained according to established 
procedures and timeframes, Information used to process the request that is not ultimately 
sent to the requesting agency is n ursed at th e close of the request. Information sent to the 
requesting agency is stored in the j | in accordance with the app! ieable retention 

oos oe tos smmmuv hk>. of '.ems alter the end of the calendar <- ear in- ohseh a r\v 
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2. Does the systera/projeet collect, maktiam* or disseminate any information e 
sndivlduals (Le„ a N .an being or runes' f person, regardless of nationality)? 

NO if f on, SI Off fde FFA Is new eeroplNe and afler dlssskut srpproval 
should be ooko to fill OOC7FO. 1 Nr float PHI tspprssvos. lubes you 
urberoisse aslvtsed, no FI A Is .r'eesdfedJ 

X YES f if yes, please eootmoe. j 

3. ' e so d vOk ss arp of the v v ' ' oo ' tothx o,.i \ 

system about ~ N ouah Bear In suindlhst log-oo information b u n or 
lisskahk v an us.duuiu.xl 

(Cheek all that apply.) 

_\ The isEbnrsation J ci-oo identities specific Indi viduals. 

\ IN' snfot-mauen *a unendod to So toe l a" eor.ua <.,s~.pn.usds wlv: d da N 

V vf 0\ t V \ „ w \ XV v 

x i o v ' v.\ - op C u v v >. 

is linked or linkable to specific individuals). 

If yon marked any of fits afnmy proceed 1st Question 4, 

None of the above, it none of the above., describe why the .inio.rrnation t 
\U N NO..'; k 5tvV ,oh oJ?k v . OS i C V "U C'Nu koO S'Ss' V 

NTOF here after providing tie t enuestvsi deseripIiun J 

4. IXv'- the swons pro V5 , rn;'.?■ «N|> o .,o\ersoueus ernrhyecs. conn sekus, 
consultants:? 

_X NO .YES 


5. N i ot -7'oi.n . s 3 Staton x A- os ion IN v adunoed pentnusutst' 

ai-osn s'etr o.xT, Pr sIr> wets p.esee* b> N ste ox > N pvOn-n.i i is >!) .' 

NO, | If 8o x skip to guess lost A) 

_X..YES, f If yes* proceed to the nest gueMksn,| 


oes the sysiem/pi'ojeet collect any information directly Iron's the person vs i 
: t of she sntooBksnssf' 


NO |ff on, proceed to guestkm ~.l 
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Aside horn audit logs, the system does not directly collect information 'from 
individuals. However, individuals may provide PH to the requesting agency, 
and the requesting agency will provide that nAonneuon to the FBI in order to 
initiate lire nante check. When applicable, the requesting agency is 


responsible for obtaining consent trout the individual to share the information 
with the FBI to perform the check. 



YFS flf yes, proceed to ffuestion 7.f 



At M t he program wilt need to work with PCI I' to dec eiep'impletneat 
the necessary ihrrathsbj 


YES Identify arty forms, paper or eleelrosttiy used to request such 
mim'matkm from the information subject:; 

system,-'projeet? FuU SANs should only be used as identifiers in limited instances. 


X YFS If yes, cheek all that apply; 
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encrypted., hidden irorn ad users via a look-up table, or only available to certain 
v " '' KwoUh , h o 


SS'NT. Evplatm 

No, 

considered Privacy Act systems of records. The f ederal Acquisition Regulation 
contains startdard contract elooses that most he ore tinted in the event tire system 
collects, maintains or dissert'd nates PH and additional requirements may be 
Imposed as a mater of Department of Justice pot Icy. Consultations with the 
Office of the Genera! Counsel may be requited H a. eontractor is operating the 
system for the FBI. 

Security Division (SecDO 

X_NO If no. indicate reason; if CAT A is pending, provide anticipated 

i.empkt!"0 date ' ' ^ " „ *■ . ' \ 

Requirements phase of the FBI Idle Cycle Management (LCY!) process and will 
ao through the Cafe A process. The estimated completion date is PY 200/ FY'2014. 

V’PS If yes, pk-aae Indicate the following, if known; 

Provide date ef last CAT A e«rti.fIcafin'.tr/re-eertlftcalion ; 

Clon.tldan.liali ty: fans.Moderate High if ndefmed 


Integrity: .Low Moderate High Undefined 

Avadalnldy: Low Moderate .High Undefined 


Not applicable - this system is only paper-based. 
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Is tins sysmoe payee: the subject of an OMB-aOCi budget submission; 

X NO sThe National Name Check Program is a iee-dor-sarvwe program: 
so an OMB-300 budget subnnssmn :s not required'! 


YES If yes, please provide the date anti sat* or 



If yes, please describe the data ndnfog function: 



This is a neve systenk project in development:- id f yoa cheeked On 
. The FTA is now cnawdete and after division approvals.: should 
tied to FBI OdfNPCXF fee dad FBI approval nod rkdcroBnarmi 
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(For example. a change that would create a more open environment and/or 
avenue for exposure of data that previously did not exist/} 

A change that results in information in identifiable ibrm being 
merged, cenlnbleed, or matched with other databases. 

A. new method of authenticating the nee of and access to 
Information in idenll.habie lorn- by members of tire public, 

A systematic incorporation of databases of information in 
identifiable form purchased or obtained from commercial or public sources. 

A new mieragsoey use or shared agency thnebon that results in 
new uses or exchanges ofiniormation in identifiable form, 

A change that results In a. new use or disclosure of in.ibrma.tion in. 
idcot bbbbs ibrm. 

A change that results in new Items of irdbrntation In Idee! I liable 
Ibrm being added into the systenbpojvci. 

Changes do not involve a. change tn the type of records maintained, 
the individuals on whom records are maintained. or the use or 
dissemination of Information from the system/protect. 

Other |Provide brief explanation]; 

.1 Docs a. Pi A for this sy sterwprmeet already exist? 

.NO .YES 


If yes : 

a. Provide date/titlc of the PtA: 

h Has the system pwyes! undergone any significant changes since the PtA? 
.NO Yf.S 


I the PTA is now complete anti alien division copras sad Amok! be submitted to 
Ebi ClflC/rOdj Err final FBI a on woo: and determination d Pits and/or other 
•act.lorn? are repaired,I 
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( la-'atk.amn: i'neUwGtVd 
( as cats; lone 


FINAL FBI APPROVAL / DETERMINATIONS / CONDITIONS; (This section will be completed by the. FBI 
Ml CTC 1-0 follow lag £ \ % submission Ihv PI v ^Isu Am uhi «Jdgt lo t he m w |M> ' and coaBm te -1 

__ FiA is required by the E-Government Act. 

_FIA is to fee completed as a m \ttt P! I '(> ' tehon 

Is PIA to be published e FBI.GOV (alter any RMD F01A redactions)? Vvs .No (mOicate reasonj: 


PIA is no; respired lot the following re&soma» 

System docs notcoHect maintain, or disseminate PIL 

System i get Fathered (in exAF^b before I solatore "gv oos t'iqm; fovaev 4$ 

_Information in the system relates to internal government operations. 

„_System hr- been previously assessed under an evaluation similar to a FIA. 

.No significant privacy issues (or privacy issues are onchrmged). 

.Oilier (describe): 


Applicable SOKNes 

Norjtl FBIRMD/RIBS per MKXi IFO.2.3? .No h s w^oMh' ^rb t n x 'iovielv 

hn | 'et>'W N ^ ' R I Cl t e \koCss' K kiU^ 1 1 f*' 1 ' v > otmgMV-'Msk. v rd 

SOIiN/SORN rovisionts) required? No _Yes (indicate revisions needed): 


1' UV iO A I V. . ')sK' v o i OMivi 'x No )«'<* ">a h \ d 


RECORDS. 1 be pi-mam should consul o tth RMD m identity resohe any Federal records elec trank records issues 
IM nor vontain K\Rkh xoowN ohether ot n-c It v. ukons Ps wav \vt soqncsw v\t m nw event. a records 

schedule approved by the National Archives and Records Administration is necessary. RMD can provide advice on this 
as well as o?i compliance with requirements for Electronic Rec ord keep i ng C ertification a nd any necessary updates. 
Other: . 



James h I andon, Deputy General C suns®! Signature 

R y > a V » s Drf v * v y , \t 


Class I ficitf Inti: C nciassil'led 
Ca ven t s; None 
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L INFORMATION UWH !' UiFMSlFM ' PROJFC T 


L Provide a geo craI descripSit<>o of five system or project that tneiodess (a) Borne of 
the sysieBt/projeet, ttK'ludiug ustmoinied acronyms; (h) sh ru e tore of the 
systetn/projeek sstdodhtg Interconnections with other projects or systems: fcj 
porpo.se of the systendprojeet; fd| nature of the Information In the systeon/project 
end how If will he used; (e) who wilt hove across to the micron* Hon In the 
sysfomlprojeet; (ft and the ntaoner of transntisston to all users, 

Cunemh or she S- s res Ft i: we s * u*e y oou'tmneeVr V.fi rod" Fd w \ >> 
p; <' des presence, lactam it v°o tyme and Incited \ tde% eem\. tenet to to aF t 


cmpfosC\.s ", :t i \e\l CetKtaUoe \\ m \statx uc tV "d * h„w teatuw,, ,e„ mw'tV'ated 
Into all Microsoft Suite products to include Microsoft Office State ("Word, Excel, etc.) 
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('avMtNiX'iOt 


X NO Ilf no, STOP !1 k FT \ is mm complete o I ritvr division approv d(s) 
should in' sohuihied k> FBI U<*< Ft I i f<r tin $1 1 B1 approval 1 nkpw ire 
otherwise ads Bed, no FI A Is required.! 

_Vi S lif yes, please continue.} 

3. Please indicate it any of the following eharacierisiies apply to the information in the 
system about individuals: Bear in mind that log-on information may identify or be 
linkable to an individual. 

(Check all that apply.) 

_The information directly identities specific individuals, 

__ The information is intended to be used, in conjunction with other data elements, 

to indirectly Identify specific .individuals., 

.The information can he used to distinguish or trace an individual's identity (i.e. ? it 

is linked or linkable to specific individuals). 

If you marked any of the above, proceed to Question 4. 

None of the above. If none of the above, describe why the information does not 
identic specific units ideals either directly or indirect? |if on checked this nun, 
Sl'OF here after providing the requested description,J 

4. l\v> v e' r ok\ f > ' mh to low ( v'c > or t >es> vO ' \K f s 
consultants? 

_NO __YEN 


5. Is information about United States citizens or lawfully admitted permanent resident 
abc-ns tetnosod Non, the system yr gect h> name or other personal idemme:' 

NO, IIf no, skip to question ?,) 

..YES. fit yes, proceed to the next question,! 

(>. Does the system/project collect any information directly from the person who is the 
subject of the ..information': 

_NO flf no, proceed to question. ?.,| 


Caveats: None 
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C. ksslfkalwo: I 'ndamdkd 
Caveats: Norn) 


a. Does die systern/prqieot support criminal, CT, or PC! investigations or 
assessments'? 

.NO 


YES [If yes, proceed to question ?<] 


o \ - m-t o roe 11 hm 'v utw is >, 0 .. N ol ectod 

provided, written Privacy Act (e)(3) statement (either on the collection .form or via a 
separate notice)? 

NO [The program wifi need to work with POLE to dev dop/im p Ientmil 
the necessary fomUsyi 

.YES Identify any forms, paper or dectrouk, used to request such 

information from the information subject: 

7, \,v & v * See 5S Vo ho s sS\s oolkcml n ) o ; od d 0k i oeo hoot the 
system/prqiect? Full SSNs should only be used as identifiers in limited instances. 

NO .YES If yes, cheek all that apply; 


_SSNs are necessary to establish/confirm the identity of subjects, victims, 

unnerves or ounces m tins law a o\\ cement or : mebkmn.e act a *' 


.SSNs are necessary to identity FBI personnel in this internal administrative 

s\ stem 

__SSNs are imported for other reasons. Describe; 

_ F ~ s' S' cm pnoect pm Cv- '■•pec. d pi o', ecu on M SSV. m j S\V t 

'' oo 'door mre I uon\o tloo o »W £ m \ < aNo o ■,„ * sj 
users). Describe: 

.It is not feasible (dr the system/project to provide special protection to 

SSNs. Explain: 

.No. 


Caveats: Noise 
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'j Imbrro vwn s\stems -'feuded K s '*er'ttuco>'s ter dv HU n'u> be 

vO n x i ! ' ' ^ H V' v t\ x UltiK L UJ* '< WOl " ,*>I V- d x\ 

imposed as a matter of Department of justice policy. Consultations with the 
Office of the Genera! Counsel may bo required if a contractor is operating she 
system for the FBI. 

5 * \ r < X X XX X O 5 xV XXX * { l t\ \ ' tx I ^ 

Security Division (SeeDf' 

GO If no, Mtdkale reason? if (.'& A is pending, provide anticipated 
complotion date; 

_ _YES If yes, please indicate the following, if known: 

lEonlde dote H' last 1\E \ mrtiiknsmn rewenltkmten: 


Confidentiality: 

_laws; 

_SI oderaie 

High _ 

m Lode fined 

Integrity: 

Low 

Moderate 

.High 

Undefined 

AmliaMittyc 

Low 

_Moderate „ 

llfgb 

Undefined 


Not applicable - this system is only paper-based.. 
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10, Is this system project the eobseer of an OM.B-300 budget s^irussiun? 
NO 


YES If yes- please provide the dote and name or 
tide of the OMB submission: 

NO 

YES If yes- please deserd.se the data mining fosse No so: 

2- N this a nos tonal security system (as communed by the SecDO 
NO YES 


This is a non system protect in development, j IT you checked this block, 
STOP, The PTA Is mm complete and after division appreval(sf should fee 
-enm two to I HI <H*v 1\ I v m nr J 1 Hi ppr < ' I tad d*tu me t $u t t 
Pi A and/or other actions are respired-J 


il kyimim sssrhMN ruoiu is 

NO I if no, proueed to neat otiestion (11,3}.] 


YES b ' u ' sodNote vdm s o'Ntte OdOwmg ch cues onto no- \ purk nil 
changes that apply, and provide brief explanation for each marked change): 

tdomitOHo to a tNrmm 'hot :s Icctuibahlc or parbcuht tndtsideals 

A new use of an IT sysienmnqiecg including application of a new 

1 ihsssmcabom l : betas Elba! 
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CI a s s 5 I s eat in o; l' 5u: I a > % s b e d 
Caveats: None 

{For example, a change that would create a more open environment arnfo; 
avenue for exposure of data that previously did not exist} 

A change that results in information in identifiable form being 
mcraed, centralized, or matched with other databases. 

A new method of authenticating the use of and access to 
information in identifiable form by members of the public. 

A systematic incorporation of databases of information its 
•deoubable form purchased or obtained freer; commercial or public .sources. 

_A new interagency use or shared agency function that results in 

new uses or exchanges of inibrraation In identifiable form. 

A change that results in a new use or disclosure of Information in 
identifiable form. 

A change that results in new items of information in identifiable 
form being added into the yvskmvprojeei. 

Changes do not involve a change in the type of records maintained, 
the individuals on whom records are maintained, or the use or 
dissemination of in format ion from the system/projeet. 

_ Other {Provide brief explanation!: 

3. Does a Pi A tor this system-png act already exist ' 

_NO . YES 


a. Provide daieblUe of the Pi A: 

_NO _YES 

{The FT A is now complete and after division approval; s; should be submitted to 
FBI OGC/PCLIJ for final FBI approve! and determination If PI A and/or other 
actions ore required.,) 


(' 1 a s s i H e a t U ; n: 1 n c 1 a s s i ft e; I 
Caveats: None 
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(INSERT CXASSJFICATION/CONIWIL MARIvINGS, IF APPROPRIATE] 

n \ y rm verhov a 01 \ \riuss * oo\mnovs; \ rhkseeikm *jH i* sod »*> rh i v<; 

Ik's I 'POLO I Akm<.mc RT\ su hmft^og. Il k- PTd drifter should skip P» thy peyt page «m* onsstlmsx J 

i PIA Is reqnnod by she E-Oenosnrocro Act 

PI A is to be composed as a matser of PBs/DO J duetso-en 

I,: PTA to bo published on FBJ.GOV (after msy RAID POIA rodacaonxe' .Yes. No ; n-desuc semen b 


PIA sk no; roiiunreo for Rio EdmsGng reasons s: 

.System; does not coUeeh neltsAn. on dissentunde PH. 

_System is a mod ushered (in emsienec betera 4/1 7/2O0V oo boor changes posing signs Geerd 

.y.dmooruoson in the system redoes to m-emai govo.roose.in operaoons. 

Sys;e$:o isos boon previously assessed under an evahnatmn similar 10 a PIA. 

.. :: . No slgmiasiot privacy issues (os privacy issues arc unchanged;. 


Applicable PORN As: .... 

Neddy FBI RMD/RIDS per MIOG 1900 A .No ..Yes--See sample EC on rCl.l; asYarou website hose: 

iup:: ://i':OinN'DO/OCrC/I,TBRY7LRJ/PrivacyCivii02(R.Jberbos% dOLibrary/fosni..P/r.. nssogI ph/PG cc .svpd 


- ' v ' ' " \ N 


RECORDS. The progmtn should consult with RAID to ideotiA/resolve any Federal reeords/eieotsoea records issues. 
The sy.skns omy eomam Federal records whether or nos si eonsaim Privacy Act requests and In any ex one a records 
schedule approved by the National Archives; and Records A shy; mss mown ss necessary RMO sain provide advice on dm; 
as va il ; a s or: cornpUancc wish r eqnlrerncnrs Or Blmoonn: Rcnordkacpma /(Atmeadon and asp necessary npdnuo 





epic.org 


EPIC-14-06-04-FBI-FOIA-20150519-6th-Production 


EPIC-1624 























kh' h \ \ io\ «v\ . dot \i vrkiv^ 
ii- MTKOf'KlMi. 

L INFORMATION ABOUT THE SYSTEM / PROJECT 

I. Provide a general description of the system or project that includes: n«e of 
the system/projeck including associated acronyms; structure of the 
sysieni/projeet, purpose; nature of the information to the system and how it 
will he used; who will have access to the information ra the system and the 
manner of transmission to a.l users. 
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handling of Pil within FBI controlled ersvconruents. 
asiUzns role-based access to allow and/or restnci. access]" 


| | PI1 data front systems with ordone Pi As sn place. The 

system will not generate new PII data to be stored, housed or searched The b7E 

atsseunnate Uess aau<. Uvrough the approved channels as established by FI A 
policies and ClIS/PBi security procedures. 


2. Does the syssem/projcci collect, rmomain. or disseminate any deformation about 
individuals in identifiable torso, i.e.. is ;n form at ton linked so or linkable to specific 
individuals s which ts the definition of personally identifiable information tPlisV? 

.NO |If mo STOP. The PI'A is now complete and after division approvals w 

shook! he submitted to PBt OGC/PCLU for final FBI approval Unless you are 
oihervvise ad vised, no PI A is required. | 

NS f U s XN. '* \ . X x ,, \ V 

IF APIWMbfiorE: 
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iiVM-KUi \imscoMkot 

IF Ald'ROPEIATE] 

information from &< ^formation subject; 



..NO If m, indicate reason; If C&A k pending, provide anticipated 

completion date; 

.X.YES if yes, provide date of last C&A certilicatioys/rc-coriifk'alamv 



Don't know _ ... YES If yes, please provide 

ike date and name or title of the 
OMB submission; 



. 1 < n ^ s'- v ,v < <. t E< v „ Ji v< a Gnds<o th>\ oFhL 

STOP, The PTA Is mm complete and after division approvals} should he 
submitted to FBI OGC/PO.l for final FBI approval and determination if 
PI A a.odA>r other actions are required.] 


II.. EXISTING SYSTEMS / PROJECTS 



boxes that apply! 


| INSERT €L ASS IFIC A ?! 0 N /CO X T E O L. MARKINGS* 

A \EPICdP>I:\TK: 
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;i nseft ci- assi ¥K:a tk> n/comaoi, mark iags., 
if %vvkam<\\n 

A change from information k & format, that is anonymous or non- 
identifiable to a format that is identifiable to particular individuals. 

.X. A new use of an IT system/nrojecg including application of a new 

technology, that changes how information in idemifmhk form is managed 
tFor exarnple ; a change that would create a more open environment ami/or 
avenue for exposure of data that previously dot not exist.) 



A new method of amhenfieatmg the use of and access to 
information ;n identifkbk form by members of the public. 

A systematic incorporation of databases of information m 
identifiable form purchased or obtained from commercial or public sources. 

_ A new interagency use or shared agency function that results in 

-w', ^ > > * i at v ' t oi 

. A change thm results in a new use or disclosure of information in 

ideodbabk form. 


.X. A change that results hi new items of informarion in identifiable 

form being added into the sysimn/proieci. 



(Provide brief explanation]: 


[INSERT Ci ASblFUiXUON/rox i Rtk. MARKINGS, 
IF AFPROPRIATFI 
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dVMHi U UUJNt'OMSUM MGHOVA 

IF AlTROPUlATE1 

3. Does a PIA for this syoem/ptmeci already exist? 

.X.NO . YES 

If yes: 

a. Prmkle dare'titk of the PI 1 sex son "T cp'-woo D 3- Os 

b Has she xystem/prooees. undergone any significant changes since the PLY? 
.NO .YES 

(The PTA Is nox complete and after division approval^; -honki be submitted to 
FM OGC/PCLU tor final FBI approval and determination if PI A and/or other 
actions are required*] 


[lEsEII'r CI,A:SSIFICATl(iX/C<)KTIff)!.. IVlARKINGlS* 

IF APPR()PBlATf3 
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(OGC/PCLU (Rev. 04/01/20! 1) 


FBI PRIVACY THRESHOLD ANALYSIS (PTA) 

NAME OF SYSTEM / PROJECT: Password Reset 


BIKR FBI Unique Asset TO: 


Derived From: 

SYSTEM/PROJECT FOC 

FBI OGC/PCLIJ FOC 


Name: | | 

Name: 


Program Office; 

Phone: 

Declassify Oft ? 

Division; Information Technology 

Room Number: 

Services Division 

Phone; 1 [ 

Room Number: 1396 



FBI DIVISION INTERMEDIATE APPROVALS ._ 


Program Manager (or other appropriate 
executive as Division determines) 

Division Privacy Officer 





Program Division: 

f insert division name! 

Signature:! I 

Signature: 


Date signed: $/j&/fZ • 

Name:| | 

Title: IT Speciaiist/Svstem Owner 

Date signed 


Name! 1 

Title: Privacy Officer 

FBfMQ Division: 

(insert division name! 

Signature; 

Date signed: 

Name: 

Title: 

Signature: 

Date signed: 

Name; 

Title: 


\ \ S N \ V \ \ P> ' ' * >T S. U ft ?'BIO< < N 

CftS, VOlft " VX <- 
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FINAL FBI APPROVAL / DETERMINATIONS / CONDITIONS: [This section will foe completed by the FBI 

pcxc/p (> follow r ^ ^ o- o.ti' e_ 


__PI A is required by the E-Government Act. 

_PIA is to be completed as a matter of FB1/DOJ discretion. 

Is PIA to be published on FB1.GOV (after any RMD FOIA redactions)? 


_ Yes. _No :(MIeet«. reason): 


% PIA is not required for the follow ing reasons): 

_System does not collect, maintain, or disseminate PH. 

_System is grandfathered (in existence before 4/17/2003: no later changes posing significant privacy risks). 

Jf Information in the system relates to internal government operations. 

_System has been previously assessed under an evaluation similar to a PIA. 

_No significant privacy issues (or privacy issues are unchanged). 


_Other (describe.?: 

( PJm t ^ d iuA h flu# M 

Notify FBI RMD/RIDS per MIOG 190.2.3? V No _Yes-See sample EC on PCLU intranet website here: 

http:'Vhome/DO/OGC/LTB/PCLU/PrivacyCivil%20Liberties%20Library/formJbr_miogl90-2-3„ec.\vpd 

SORN/SORN revlsion(s) required? ji No _Yes (Indicate mv-sions needed): 

Prepare/revise/add Privacy Act (e)(3) statements for related forms? _No JOfes (indicate forms affected): 


Ol M Cfe CjjhiAt &Uf f /huf . 


RECORDS. The program should consult with RMD to identify/resolve any Federal records/electronic records issues. 
The system may contain Federal records whether or not it contains Privacy Act requests and, in any event, a records 
schedule approved by the National Archives and Records Administration is necessary'. RMD can provide advice on this 
as well as on compliance with requirements for Electronic Recordkeeping Certification and any necessary' updates. 
Other: 


Elizabeth Withnell, Unit Chief 
Privacy and Civil Liberties Unit 


FBI Privacy and Civil Liberties Officer 


Signature: 
Date Signed: 


4 


Signature: 
Date Signed: 


4/^s/r^ 
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;L IN FORMATION ABOUT THE SYSTEM / PROJECT 

1, Provide a general description of the system or project that includes: 

(a) name of the system/project, including associated acronyms; (b) 
structure of the system/project, including interconnections with other 
projects or systems; (c) purpose of tike system/project; (d) nature of 
the information in the system/project and how it will be used; (e) who 
will have access to the Information m the system/project; (f) and the 
manner of transmission to all users. 

The Password Reset project consists of an application called Avatier Identity 
Management Suite (AIMS). The application is used as a self password management tool 
for the entire I Bi e nterprise The users can reset their password tot their user accounts, 
unlock their account* or change then password. The $y stem interacts w 1th the users 
th ugh the i < iet using a web application framework called ASP.NET AIMS stores 
account information within an Oracle database. To register the changes, it interacts with 
active directory through! ightweight Directory Access Protocol (1 DAP) mid connection 
with the domain controllers. 

The information in the system concerns each user’s account information, which is 
the same information as is located in Active Directory. The database also contains 
answers to security questions for each user. The system owner has access to this 
information and the Oracle database team has access to this information. 

2. Does the system/project collect, maintain, or disseminate any information about 
individuals (i,e., a human being or natural person, regardless of nationality)? 

NO [If no* 8 i OP, The FT A is new complete and after division appro* alt's) 
should be submitted to FBI OOC TCLI for final EM approval. Unless you arc 
others* be ,wh ntd, nn FI A is required 1 

_ X YES [If yes, please continue,] 

3. Please indicate if any of the following characteristics apply to the information in the 
system about individuals: Bear in mind that log-on information may identify or be 
linkable to an individual. 

(Check all that apply.) 

X The information directly identifies specific individuals. 

__ The information is intended to be used, in conjunction with other data elements, 
to indirectly identify specific individuals. 

X_The information can be used to distinguish or trace an individual’s identity (Le., it 

is linked or linkable to specific individuals). 

If you marked any of the above, proceed to Question 4. 
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None of the above. If none of the above, describe why the information does not 
identify specific individuals either directly or indirectly. }If you cheeked this item, 
STOP here after providing the requested description,! 

4. Does the system/project pertain only to government employees, contractors, or 
consultants? 

NO X YES 


5. Is information about United States citizens or lawfully admitted permanent rest dent 
aliens retrieved from the system/project by name or other personal identifier? 

_ NO. [If no, skip to question 7.] 

.X.YES. [If yes, proceed to the next question.] 

6. Does the system/project collect any information directly from the person who is the 
subject of the information? 

_NO [If no, proceed to question 7.| 

. X .YES 


a. Does the system/project support criminal, CT, or FCI investigations or 
assessments? 

X NO 

_YES [If yes, proceed to question 7.} 


b. Are subjects of information from whom the information is directly collected 
provided a written Privacy Act. (e)(3) statement (either on the collection form or via a 
separate notice)? 

JX. NO [The program will need to work with PCLU to develop/im piemen t 
the necessary' form(s).] 

YES Identify any forms, paper or electronic, used to request such 
information from the information subject: 

Electronic “Privacy Policy & Terms of Use'’ statement 
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7. Are Social Security Numbers (SSNs) collected, maintained or disseminated from the 
system/project? Full SSNs should only be used as identifiers in limited instances. 

X NO _____ YES If yes, check all that apply: 


__SSNs are necessary to establish/conftrm the identity of subjects, victims, 

witnesses or sources in this law enforcement or intelligence activity. 

_SSNs are necessary to identify FBI personnel in this internal administrative 

system. 

_SSNs are important for other reasons. Describe: 

The system/project provides special protection to SSNs (e.g„ SSNs are 
encrypted, hidden from all users via a look-up table, or only available to certain 
users). Describe: 

__It is not feasible for the system/projeet to provide special protection to 

SSNs, Explain: 

8. Is the system operated by a contractor? 

X No. 

_Yes. Information systems operated by contractors for the FBI may be 

considered Privacy Act systems of records. The Federal Acquisition Regulation 
contains standard contract clauses that must be included in the event the system 
collects, maintains or disseminates PH and additional requirements may be 
imposed as a matter of Department of Justice policy. Consultations with the 
Office of the General Counsel may be required if a contractor is operating the 
system for the FBI. 

9. Has the system undergone Certification & Accreditation (C&A) by the FBI 
Security Division (SecD)? 

X NO If no, indicate reason; if C&A is pendi ng, provide anticipated 

completion da te: PASSWORD RESET ! ~1 b?E 

| | is a candidate for the normal security process of an 

approval to test and approval for use. 

YES I f yes, please indicate the follow ing, if known: 

Provide date of last C&A certification/re-certification: 
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Confidentiality:_Low_Moderate_High _ 

integrity: _Low' Moderate High 

Availability: _Low Moderate High 

Not applicable - this system is only paper-based. 


Undefined 

-Undefined 

Undefined 
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10. Does the system conduct data mining as defined in Section 804 of the 
implementing Recommendations of the 9/11 Commission Act of 2007, P.L. 110- 
53 (codified at 42 USC 2000ee-3)? 

.X_ NO 

__ YES If yes, please describe the data mining function: 

11. Is this a national security system (as determined by the SecD)? 

X NO ..YES 


12, Status of System/ Project: 

This is a new system/ project in development, fit' yon checked this Msek, 
STOP. The PTA is now complete and after division appreval(s) should be 
submitted to FBI OCAYff/LIJ for final FBI approval and determination If 
PI A mui/or other actions are minired.j 


II, EXISTING SVSTEMS / PROJECTS 
1. When was the system/project developed? 2008 

2* Has the system/project undergone any significant changes since April 17,2003? 
X NO [If no, proceed to next question (11,3).] 


YES If yes, indicate which of the following changes were involved (mark all 
changes that apply, and provide brief explanation for each marked change): 

_ A conversion from paper-based records to an electronic system, 

__ A change from information in a format that is anonymous or non- 

identifrable to a format that is identifiable to particular individuals. 

_ A. ne w use of an IT system/project, including application of a new 

technology, that changes how information in identifiable form is managed. 
(For example, a change that would create a more open environment and/or 
avenue for exposure of data that previously did not exist.) 

_A change that results in information in identifiable form being 

merged, centralized, or matched with other databases. 


epic.org 


EPIC-14-06-04-FBI-FOIA-20150519-6th-Production 


EPIC-1586 









__ A new method of authenticating the use of and access to 
information in identifiable form by members of the public. 

__ A systematic incorporation of databases of information- in 
identifiable form purchased or obtained from commercial or public- sources. 

A new interagency use or shared agency function that results in 
new uses or exchanges of information in identifiable form. 

__ A change that results in a new use or disclosure of information in 
identifiable form, 

A change that results in new items of information in identifiable 
form being added into the system/project. 

Changes do not involve a change in the type of records maintained, 
the individuals on whom records are maintained, or the use or 
dissemination of information from the system/project, 

_ Other \ Provide brief explanation}; 

3. Does a PL4 for this system/project already exist? 

_ X_NO _YES 

If yes: 


a, Provide date/title of the PI A: 

b. Has the system/project undergone any significant changes since the PIA? 

_NO _YES 

fThe PTA is now complete and after division approvals) should he submitted to 
FBI OGC/PC: 1,-11 for final FBI approval and determination If FI A and/or other 
actions are required.} 
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DECLASSIFIED 

hs\i fbi utko% u m iKKMrs\r«*\s coNmnovv 


Pi A 5.s required by the E-Government Act 
P.IA w 'o tv \' i ' v " omd c-s o omm o- f At DOt dwevt on 
Is P1A to be published on FBi.GOV (after any HMD FOIA redacts 


X P!A is rest required for the following reason(s): 

System -sloes not collect. maintain. or disseminate Pit 

System is grandfathered {in existence before 4/ j 70003: no inter changes posing significant privacy risks). 
Information in the system relates to internal government operations. 

System has beets previously assessed under an evaluation situ?far to a PIA. 

X No .significant' privacy issues (or privacy issues are unchanged). 

Other: 


Applicable SORNtss eBi-OiC Central Remgds Swem 


Notify FBI RMO RIDb per MiOG 190.20? .No .. X.Yes-See sample PC on PCLU Intranet v 

' '< •> ^ ' N C< ‘ O v V , \ ( v s v A < X V. ' ! 0 V ' > ' s „ X U -> 


SORN/SORN rev-stents) required? No Yes: 


^ \ ' ^ '< vs v N ' - ' - v x , v. ' 


RECORDS. The program should consult with RMD to idemi.ly/resolve any Federal reeords/eiectronk records issues. 
The system may contain Federal records whether or not it contains Privacy Act requests and. in any event, a records 
schedule approved by tire National Archives and Records Adnunisbadon is necessary. RMD can provide advice on this 
s well as on compliance with requirements for Electronic Recordkeeping Certification and any necessary updates. 


Other: Although the system is changing from paper to electronic records, the system will stilt only be accessible to one 
individual burthen the names of participants will be deleted from the sy.fgs£!h I SO days after their completion of the 

' < .1 s \ ' ' v' is ' ns.. U SWS <■ s * < S 

p'w.uw dor, on ntetson 


Privac 


_|\cting Unit Chief 

and Civil Liberties Unit 




Jacqueline F. Brown. Acting Deputy General Counsel Signatures 
FBI Pri va c y and Civil Liberties Officer we foe \o uVshIutN 
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I. INFORMATION ABOUT THE SYSTEM / PROJECT 


L Provide as general description of the system or project that indudes: (a) memo of 
the system/projeet, including associated acronyms; <b) structure of the 
sysfem/projeef, indndlug interconnections with other projects or systems; (c) 
purpose of the system/project; (d) nature of the information in the 
sysiens/projert and how it will he used; (e) who will have access to the 
information rn the system/project; (!) and the manner of transmwsioo to all users, 

l v \.e, rod U,\vt's 'hweai ! ".ress Uv^no"' - 1 ! \' Oa,a\ve w ,s tccem 
keeping system, containing health and fitness information ox individual National 

V- - V V N \ " V ' M , , \ 

state and local law enforcement officers. The PFA database is comprised of an Excel 
spreadsheet stored on a local nnei&ssiikd computer, not on. a shared drive. The 

\iK”' Cs 00 V 000N 0 V-WJ - >\ ,10 X's " yO ' ", S, 

rncasnrernents, pulse rates, mile run time, and results of other various physical tests. 

The inibnnation collected helps the Physical Training Unit (PTU) provide students 
with pro and post training assessments. In addition, the PTU' uses the information to 
ewate t w.odw. ape owed pew; Ode t uAme fo? o.k i foofo ,dn 0 \ev- "n o \1 to; a 1 
cumulative sessions. The system is accessible only to one individual, and is not 
transmitted to any other' individuals. In the event where the performance data may be 
shared (tor research purposes), the names are removed so that data cannot be linked to 
any participants. In addition, the names of participants veil! be deleted from the system 
1 SO days alter they .have completed the program. 


2. Does the system/prqiect collect, maintain, or disseminate any information about 
individuals the., a human being or natural person, regardless of nationality)? 

.NO 

X YES |If yes, please continued 

3. Please indicate if any of the following characteristics apply to the information in the 
system about individuals: Bear in mind that log-on information may identity or be 
lusfofole to .a; indh ideal. 

,UK\ s ; > 0 a wph t 

_\_ the mfotmetmn eaemU \lewnh"- -pecan indh'duals 

>s - J 'fo we wo X' " ' ! e «setwi¬ 

se indirectly identify specific individuals. 

\ - o o - , o«. v o ’ s - m 

is linked or linkable to specific individuals). 
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If you -marked any of the above, proceed to Question 4, 

None of the above. If none of the above, describe why the information does non 

! <■ S V s * s > 

4. v, 'N v Vs ' S V V v. 1 V S ! ' 

consultants? 

X.NO .YES 

5. O' ' s - s n f ! ! \ t A ev c 

.s'' s' s s 'Ms . ,N V S \ 's 's s 1 s 

NO. {If no, sldp to question 7,j 
X YES. (If yes, proceed to the next question.) 

6. \s } s ''Ns ss s ss V'' s, sv ' ' . e N 

subject of the information? 

NO (If no, proceed to question ?.] 

.X . YES 

s tv pro: eet support et s s estigations or 

assessments? 

X NO 

YES (If yes, proceed to question ?.{ 


b. Are subjects ofmionnatkm from whom the information, is directly eoliceied 
provided a written Privacy Act (e)(3) statement (either on the collection form or via a 
separate notice)? 

.NO 


X.YES Identify any forms, paper or electronic, used to request such 

information from the information subject: An appropriate (e)(3) 
notice has been developed and is now being used. 

7. Are Social Security Numbers (SSNs) collected, maintained or disseminated from the 

' N v s\\ s' s < ' \ s 's 1 s S s Ns 
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SSNs are necessary to establish/conErm the ident ity of subjects* victims, 
oimesaes or sources m hum hm euHrcemeea or eueieeeni.e oeb\ uy 


'•'"■'V , \s-* \ \ l s > ' ! \ s -* N * ^ m v 

m stem. 

.SSNs ere important tor other reasons. 'Describe: 

1 he s\ m-m psom: n:<" hka meuul protection u> Sv\s om, . vSV. me 
*u v. ^ v. n ' N - v. e ^ *. 

users'; Describe; 

it is not feasible for the system project to provide special protection to 
SSNs. Explain: 

Is the system operated by a contractor? 

..X.No, 


x ' t > OCO ’ov" 'V'V * x ' ^ \ - 

considered Privacy Act systems of records. The Federal Acquisition Regulation 
contains standard contract clauses that must be included in the event the system 
colleens nimrumus or disseminates Pll and additional reqturenn.ntr runs tx 
imposed as a matter of Department of Justice policy. Consultations with the 

' v N \ , *! * » 

•y.sk'Hi for she HU. 

I !u\ t te p stem endemono v'ondkat ms Jc \eexdu uvn icN V> N she FBI 
Security Division (SecD)? 

_X_ NO If mo, indicate reason; if €& A is pending, provide anticipated 

completion date; The information is kept on a local excel 
spreadsheet, and is used only for PTU health ana fitness purposes. 

.YES If yes, please indicate the following, if known: 

Provide date of last €<&A certitlcalion/re-eertiflcatiom 

Confidentiality:.LowModerate.High_Undefined 

Integrity: _Low_Moderate_High t ode-fined 


t'Xn.AUMHFB 
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